MagizAI MCP starter: Clinic appointments
========================================

Patients check opening hours and prices, see free slots and book, and signed-in patients see
their own upcoming appointments.

Full guide: https://magiz.ai/mcp#healthcare-clinics

SET UP (about 10 minutes)
1. Upload this folder to your website, for example to public_html/mcp/.
   Needs PHP 7.4 or newer with PDO SQLite (for the demo data) or PDO MySQL.
2. Copy config.sample.php to config.php and set 'token' to a long random secret.
   For example, run: php -r "echo bin2hex(random_bytes(24));"
3. Open https://yourdomain.com/mcp/index.php in a browser. "Method not allowed" means
   it is working (MCP only uses POST).
4. In MagizAI: Skills > MCP servers > Connect a server. Address: the URL above.
   Authentication: Bearer token, and paste the same token.
5. Press Manage and set the tools like this, then Save tool choices:
  - clinic_info: Safe
  - find_slots: Safe
  - request_booking: Sensitive (the visitor confirms with a code)
  - my_appointments: Safe, "patient_email" filled from the signed-in visitor
   Sensitive tools start switched off: turn them on under Skills.
6. Ask your assistant a question from your own website's chat.

WHAT IT LOOKS LIKE
  Visitor:   Can I see a doctor tomorrow morning?
  Assistant: Yes. Tomorrow Dr. Aisha Rather is free at 09:00 and 09:20, and Dr. Imran Shah (children) at 10:00. Which one suits you?
  Visitor:   9:20 with Dr. Rather please, it's for a cough. I'm Sara Ahmed, sara@example.com
  Assistant: To book 09:20 tomorrow with Dr. Aisha Rather, please type the code 482915 to confirm.
  Visitor:   482915
  Assistant: You're booked for 09:20 tomorrow. Your reference is RFC-3A91C2. Please arrive 10 minutes early.

USE YOUR REAL DATA
The demo runs on a small SQLite database created from seed.sql on first use. To use your own
system, set 'dsn', 'db_user' and 'db_pass' in config.php and change the SQL in tools.php to
match your tables. Each tool is one block in tools.php; keep the descriptions clear, because
the assistant reads them to decide when to use a tool.

SECURITY
- The server refuses to start with the sample token.
- .htaccess lets the web reach index.php only. On nginx, deny everything in this folder except
  index.php yourself, or data.sqlite and config.php could be downloaded.
- Tools that read a customer's own data must have their email argument set to "Filled from
  the signed-in visitor" in MagizAI, so nobody can type someone else's email.
- Tool errors are written to the PHP error log, never shown to visitors.
